Mailchimp MC4WP Vulnerable to Reflected Cross-Site Scripting

CVE-2024-8850

Summary

The Mailchimp for WordPress plugin has a vulnerability that allows for Reflected Cross-Site Scripting through the misuse of the 'email' parameter. When placeholders like {email} are utilized, inadequate input sanitization and output escaping become apparent. This flaw enables attackers without authentication to inject malicious web scripts into pages. A successful exploitation requires the attacker to deceive a user into performing an action such as clicking a link, which triggers the execution of the injected script, posing significant risks to user data and website integrity.

References